Meraki

PhilipDAth · ‎Sep 26 2017

Go: Systems manager/Settings/Add/More Android/Android Systems Apps Change the list type to "Blacklist" and save it.

PhilipDAth · ‎Sep 26 2017

I'm not clear on the issue. Are you worried about a user with a non-MDM controlled device setting up their own device with ActiveSync so they can get their email on their personal smart device?

PhilipDAth · ‎Sep 26 2017

Why does it need to other connections to the ASA?

PhilipDAth · ‎Sep 26 2017

Do you have any other VPNs configured at the moment, either AutoVPN or site to site VPN?

PhilipDAth · ‎Sep 26 2017

One tip I can give is don't use a domain of ".local" in your DHCP scope. If you are using Meraki you might now have a domain defined at all, but using ".local" makes it unreliable (".local" is a reserved domain for when there are no DNS servers).

PhilipDAth · ‎Sep 26 2017

If you think I helped it would be great if you could give me some Kudos.

PhilipDAth · ‎Sep 26 2017

In a word, yes.

PhilipDAth · ‎Sep 26 2017

They'll transfer to the new device - but take some screen shots as a backup.

PhilipDAth · ‎Sep 25 2017

Yes, I am suggesting a double NAT. So your xDSL router might have 192.168.1.0/24 on its internal LAN. You plug the MX's WAN port into that, and you might have 192.168.10.0/24 on the LAN side of the MX. Yes, you can port forward from the xDSL router to the MX, and then from the MX to your internal servers. I have done this exact arrangement before. However, for the amount of time that you'll failover you might want to consider if it is worth going to that much trouble. Most of your services you describe connect "out" and will work anyway, so if you didn't bother with inbound NAT you would still be mostly functional.

PhilipDAth · ‎Sep 25 2017

I found this related thread. https://discussions.apple.com/thread/5601933?tstart=0

PhilipDAth · ‎Sep 25 2017

What are the issues you are having?

PhilipDAth · ‎Sep 25 2017

Here are some links to the relevant ISP pages for RBI. https://www.vodafone.co.nz/broadband/rural/ https://www.spark.co.nz/shop/internet/wirelessbroadband/ And before anyone asks - I don't work for an ISP and have no financial interest in promoting any particular ISP.

PhilipDAth · ‎Sep 25 2017

You should see if RBI is available at your site. For some sites that are a bit "rough" we sometimes deploy dual RBI circuits from different carriers (such as Spark and Vodafone). It is not uncommon for one to not perform that well - but unusual for two at the same time to have an issue. https://broadbandmap.nz/

PhilipDAth · ‎Sep 25 2017

The MX does not have a DSL port, so it can not do PPPoA. The best option is to use the ISP modem (or any standard DSL modem) configured in "normal" NAT mode, and giving out DHCP addresses on its LAN side. Then plug the MX WAN port into that router (where the MX wan port is configured for DHCP [the default]). I know it is using two devices - but this approach works best.

PhilipDAth · ‎Sep 25 2017

I note that the Cisco cable kit also has specific ARP filtering available. I wonder if your ISP uses this: https://www.cisco.com/c/en/us/td/docs/cable/cmts/feature/cblarpfl.html

PhilipDAth · ‎Sep 25 2017

Your static configuration is correctly aligned, no issues there. I found other people with other types of kit having the exactly the same issue. https://supportforums.adtran.com/thread/2021 So I think it is a common issue with this ISP. Perhaps we can solve this a different way. Why do you need a static IP on the MX unit? Why can't you use the DHCP assigned address?

PhilipDAth · ‎Sep 25 2017

There is clearly some issue with ARP happening. Lets check some basics. Could you give me the IP address, subnet mask and gateway on the WAN interface on one device with a problem. Please just put "x.x" for the first two octets to protect yourself. So change 1.2.3.4/255.255.255.252 to x.x.3.4/255.255.255.252/ Are the sites fed by fibre, or some other technology (such as bridged PPPoE)?

PhilipDAth · ‎Sep 25 2017

Check out this article: https://documentation.meraki.com/MR/Monitoring_and_Reporting/Bad_IP_Assignment_Configuration

PhilipDAth · ‎Sep 25 2017

First; is this happening on MX security appliances or some other Meraki device (and if so, what)? Assuming it is an MX how do you connect to the ISP? PPPoE? DHCP? Static IP?

PhilipDAth · ‎Sep 25 2017

All the hubs/spokes will have to re-establish the VPNs with the warm spare after a failover event. Warm spares do not have VPN state synchronised with them.

PhilipDAth · ‎Sep 25 2017

Remove the existing MX60 from the network, and then add the new MX84 to that same network.

PhilipDAth · ‎Sep 25 2017

Not to the best of my knowledge.

PhilipDAth · ‎Sep 25 2017

Can you control it via group policy?

PhilipDAth · ‎Sep 25 2017

I've only ever done it using Windows machines, which allows you to do it via group policy. If you are using PEAP/MSCHAPv2 and you use a public certificate on your RADIUS server (that matches its domain) then you don't need to deploy any certificates to devices,

PhilipDAth · ‎Sep 25 2017

If you think the information I supplies was helpful it would be great if you could give me some Kudos.

About PhilipDAth

PhilipDAth

Philip D'Ath

Community Record

Badges